CVE-2026-4857 | THREATINT

Description

IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects. Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.

PUBLISHED Reserved 2026-03-25 | Published 2026-04-15 | Updated 2026-04-16 | Assigner SailPoint

HIGH: 8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Problem types

CWE-863: Incorrect Authorization

Product status

Default status

unaffected

8.5 (custom) before 8.5p2

affected

8.4 (custom) before 8.4p4

affected

Credits

wildwildwes reporter

References

www.sailpoint.com/...thorization-vulnerability-cve-2026-4857

cve.org (CVE-2026-4857)

nvd.nist.gov (CVE-2026-4857)

Download JSON